

import pyshark
import re
import base64
from Godzilla import *

#https://blog.csdn.net/valecalida/article/details/113108888
captures = pyshark.FileCapture("gs.pcapng",only_summaries=False,display_filter="http.content_length")
tmp=[]
#print(captures[0].http.file_data)
for c in captures:
    for i in c:
        try:
            if  "<" not in i.file_data:
               tmp.append(i.file_data)
        except:
            continue
decrypter = PHP_XOR_BASE64(pass_='pass', key='3c6e0b8a9c15224a')
for i in  tmp:
    if "pass=" in  i:
        data = decrypter.decrypt_req_payload(i.encode())
        print(data)
    else:
        data = decrypter.decrypt_res_payload(i.encode())
        print(data)
